CVE-2026-90984

The Generate PDF using Contact Form 7 WordPress plugin (versions

EUVD-2026-82601

A vulnerability was found in O-RAN-SC SMO OAM 2025-06-10. Affected by this vulnerability is an unknown functionality of the component VES Collector. Performing a manipulation results in allocation of resources. The attack may be initiated remotely. The exploit has been made public and could be...

CVE-2026-93309

A vulnerability was determined in O-RAN-SC SMO OAM 2025-06-10. Affected by this issue is some unknown functionality of the component VES Collector. Executing a manipulation can lead to allocation of resources. The attack may be launched remotely. The exploit has been publicly disclosed and may be...

CVE-2026-93488: Allocation of Resources Without Limits or Throttling

A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAXVALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYNSTREAM...

CVE-2026-93309

CVE-2026-93309 affects the VES Collector component of O-RAN-SC SMO OAM (version 2025-06-10). The vulnerability involves uncontrolled resource allocation within an unspecified functionality of the collector, allowing a remote attacker with low privileges to trigger a partial availability impact. C...

CVE-2026-93308 O-RAN-SC SMO OAM VES Collector allocation of resources

A vulnerability was found in O-RAN-SC SMO OAM 2025-06-10. Affected by this vulnerability is an unknown functionality of the component VES Collector. Performing a manipulation results in allocation of resources. The attack may be initiated remotely. The exploit has been made public and could be...

grafana: Grafana: Denial of Service via unbounded memory allocation in plugin resources endpoint

A flaw was found in Grafana. An authenticated user can exploit a vulnerability in the plugin resources endpoint by sending a request that causes unbounded memory allocation. This occurs when the system attempts to read the entire request body into memory. Successful exploitation can lead to an...

CVE-2021-31805

CVE-2021-31805 CVE-2021-31805（Apache Struts2）的PoC 这是CVE-2021-31805解説文章中使用的应用程序。 设置 root@kitploit: $ docker-compose build $ docker-compose up -d 运行确认 访问 http://localhost:8080/struts2-showcase-2.5.29/index.html 并确认Welcome页面显示。 Exploit root@kitploit: $ curl -I...

CVE-2021-26855-PoC

CVE-2021-26855-PoC 针对 CVE-2021-26855 的 PoC 漏洞利用代码。 原始代码由 https://github.com/GreyOrder 开发。 CVE-2021-26855 SSRF 简单利用的 golang 练习 受影响版本 root@kitploit: Exchange Server 2013 低于 CU23 Exchange Server 2016 低于 CU18 Exchange Server 2019 低于 CU7 使用条件 此漏洞不同于以往的 Exchange 漏洞。该漏洞不需要可登录的用户身份，无需授权即可获取内部用户资源。它可以与...

CVE-2026-83484

Vulnerability in the Oracle US Federal Human Resources product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle US...

CVE-2026-12358

IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources...

CVE-2026-11926

IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources...

CVE-2026-19504 Fabric.js loadFromJSON Server-Side Request Forgery Vulnerability

Fabric.js loadFromJSON Server-Side Request Forgery Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Fabric.js. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on t...

EUVD-2026-78893

IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources...

EUVD-2026-78876

IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources...

CVE-2026-12358

IBM Verify Identity Access (11.0.0–11.0.3 IF1) and IBM Security Verify Access (10.0.0–10.0.9.2 IF1), including their container variants, are susceptible to a denial of service via CWE-674: Uncontrolled Recursion , caused by insufficient validation of incoming request resources. The CVSS 3.1 base ...

CVE-2026-91199

Refly through 1.1.0 contains a server-side request forgery vulnerability in the POST /v1/misc/scrape endpoint that fetches caller-supplied URLs without validating the scheme, host, or resolved address. Authenticated attackers can make the backend issue requests to loopback, private, and link-loca...

CVE-2026-91199

Refly (versions through 1.1.0) is affected by a server-side request forgery (SSRF) vulnerability in the POST /v1/misc/scrape endpoint. The endpoint fetches caller-supplied URLs without validating the scheme, host, or resolved address, allowing authenticated attackers to make the backend issue req...

CVE-2026-13260 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request resources...

CVE-2026-13260

IBM Verify Identity Access (and IBM Security Verify Access ) is vulnerable to a remote denial of service caused by insufficient validation of incoming request resources. The CISA ADP assessment rates exploitation as none , the vulnerability as automatable , and technical impact as partial . No sp...